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DETAILED ACTION 

This is a response to Applicant's request for continued examination filed on October 5, 
2007. Claims 1, 12, 13, 18, 19, 21, and 37 have been amended. Claims 1-33 and 37- 
39 are now currently pending. 

Response to Arguments 

1. Applicant's arguments, see Remarks, filed on August 6, 2007, with respect to 
claims 1 under 35 USC 112, 2 nd Par., and claims 18 and 33 under 35 USC 101 have 
been fully considered and are persuasive. The rejections of claim 1 under 35 USC 1 12, 
2nd Par., and claims 18 and 33 under 35 USC 101 have been withdrawn. 

2. Applicant's arguments, see Remarks, filed on August 6, 2007, with respect to the 
rejection(s) of claim(s) 1-6, 9-21, and 39 under 35 USC 102(e) as allegedly being 
unpatentable over Malcolm [US 7146638 B2] and in view of Chakravarty [US 
2004/0128545] have been fully considered and are persuasive. Therefore, the rejection 
has been withdrawn. However, upon further consideration, a new ground(s) of rejection 
is made in view of new prior art by Coley et al. [US 5826014], Hedge [US 6925495 B2], 
Keane [US 2003/0131263 A1] and Chen [US 700006 B1]. Refer to Claim Rejections 
section below for further details of how the rejections are made with respect to these 
new prior art. 
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3. Applicant's arguments filed, see Remarks, filed on August 6, 2007, with respect 
to the rejection(s) of claim(s) 21-26, 30, 33, and 37-38 under 35 USC 102(e) as 
allegedly being unpatentable over Malcolm [US 7146638 B2] and in view of Chakravarty 
[US 2004/0128545] have been fully considered but they are not persuasive. 

Applicant argues that Malcolm neither teaches nor suggests the amended claims 
as recited especially that of independent claim 21 . The Applicant; however, did 
not go into detail how Malcolm alone does not teach the amended claims. 



The Examiner respectfully disagrees. The Examiner responds that Malcolm 
alone teaches the amended claims. Refer to Claim Rejection section below 
detailing how Malcolm teaches the amended claims. 
4. Applicant's arguments with respect to claims 27-29, 31-32, and 39 have been 
considered but are moot in view of the new ground(s) of rejection in view of previously 
cited art by Malcolm [US 7146638 B2] and in combination with new prior art by Keane 
[US 2003/0131263 A1] and Chen [US 700006 B1]. Refer to Claim Rejections section 
below for further details of how the rejections are made with respect to these 
combinations of prior art. 

Claim Rejections - 35 USC §112 

The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 
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1. Claim 24 recites the limitation "wherein establishing the policy...". There is 
insufficient antecedent basis for this limitation in the claim. It appears that the 
"establishing of the policy..." is referring back to the un-amended parent claim. For 
examination purposes, the Examiner interprets "establishing the policy..." as providing 
all access rules/requirements by the application program. 



Claim Rejections - 35 USC § 103 



The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 USPQ 459 

(1966), that are applied for establishing a background for determining obviousness 

under 35 U.S.C. 103(a) are summarized as follows: 

1 . Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the prior art and the claims at issue. 

3. Resolving the level of ordinary skill in the pertinent art. 

4. Considering objective evidence present in the application indicating 
obviousness or nonobviousness. 

1. Claims 1-5, 7-15, and 18-20 are rejected under 35 U.S.C. 103(a) as being 

unpatentable over Coley et al. [US 5826014], hereinafter Coley, and further in view of 



Montenegro [US 6233688 B1]. 
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Regarding claim 1, Coley teaches a computer-implemented method, comprising: 
receiving, by an operating system and/or an enforcement module which is associated 
with or is part of the operating system [US 5826014, Col 7, Ln 5-20], a call [US 
5826014, Col 7, Ln 37] from an application, the call having parameters for a connection 
to an endpoint that the application desires to establish [US 5826014, Col 8, Ln 6-12], 
whereby the application explicitly communicates a request to establish the connection 
[US 5826014, Col 8, Ln 3-4 -- Examiner notes that a reliable request by the application 
would have meant that the application "explicitly" communicated a request which 
required only a minimum requirement verification before being connected as cited.]; and 
making, by the operating system and/or the enforcement module [US 5826014, Col 6, 
Ln 9-11], a call to a firewall to establish the connection in accordance with the 
parameters [US 5826014, Col 10, Ln 35-39]. 



Coley does not explicitly teach an application programming interface. Montenegro 
teaches a firewall traversal method regarding loading an application programming 
interface (API) onto the client system [US 6233688 B1, Col 7, Ln 17-20]. 

It would have been obvious to one of ordinary skilled in the art at the time of invention to 
implement an application programming interface as taught by Montenegro. The 
suggestion/motivation for implementing an application programming interface would 
have been to provide an interface between applications and the operating system 
achieving a form of standardization for applications to interface with the operating 
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system. Montenegro is an analogous art because it solves the problem by providing the 
means of an interface between applications and an operating system. 

Regarding claim 2, Coley and Montenegro teaches the method of claim 1, further 
comprising, at the firewall, evaluating the parameters with respect to a policy [US 
5826014, Col 7, Ln 65-67 - Examiner notes that a proxy agent being able to 
distinguish from a set of verification tests whose rigorousness is dictated by the 
characteristics of the application access request is evidence of a policy being used.] 
and, if the parameters meet the policy, establishing the network connection in 
accordance with the parameters [US 5826014, Col 9, Ln 1-31] [US 5826014, Col 10, Ln 
35-39]. 

Regarding claim 3, Coley and Montenegro teaches the method of claim 1, wherein the 
parameters comprise a known endpoint to which the application would like to be 
connected [US 5826014, Col 10, Ln 3-5]. 

Regarding claim 4, Coley and Montenegro teaches the method of claim 3, wherein the 
parameters further comprise a request to limit the connection to a single connection [US 
5826014, Col 9, Ln 34 - Examiner notes the validity check of one or more specific 
source addresses reads on limiting to a single connection.]. 
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Regarding claim 5, Coley and Montenegro teaches the method of claim 4, further 
comprising, after the connection has been established, closing the connection in 
accordance with the request [US 5826014, Col 12, Ln 59-61]. 

Regarding claim 7, Coley and Montenegro teaches the method of claim 1, wherein the 
parameters comprise limiting the connection to a subset of interfaces, local addresses, 
or remote addresses, or combinations thereof [US 5826014, Col 9, Ln 33-36], 

Regarding claim 8, Coley and Montenegro teaches the method of claim 1, wherein the 
parameters comprise a timeout policy for the connection [US 5826014, Col 9, Ln 61-67], 

Regarding claim 10, Coley and Montenegro teaches the method of claim 1, wherein the 
parameters comprise information about a property of a flow that requires special 
handling [US 5826014, Col 11, Ln 54-55], 

Regarding claim 11, Coley and Montenegro teaches the method of claim 10, wherein 
the information comprises a request for authentication or encryption handling [US 
5826014, Col 1 1 , Ln 54-55 - Examiner notes that the necessity of password information 
reads on authentication.]. 

Regarding claim 12, Coley and Montenegro teaches the method of claim 1, wherein the 
application explicitly communicates the request to establish the connection by opening a 
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listening socket [US 5826014, Col 6, Ln 5-7 - Examiner notes that is inherent for each 
proxy agent to open a listening socket to its designated port to monitor incoming access 
requests from an application explicitly communicating a request to establish a 
connection.]. 

Regarding claim 13, Coley and Montenegro teaches the method of claim 1, wherein the 
application explicitly communicates the request to establish the connection by 
connecting to a socket [US 5826014, Col 7, Ln 42 - Examiner notes that a request 
attaching to a particular port is evidence that the application explicitly communicating a 
request to establish a connection connects to a particular socket that was opened by a 
particular proxy agent.]. 

Regarding claim 14, Coley and Montenegro teaches the method of claim 1 , wherein the 
call to the firewall is made via a firewall application programming interface [Examiner 
notes that an application interface is inherent in any kind of communication between 
applications.]. 

Regarding claim 15, Coley and Montenegro teaches the method of claim 1 , wherein the 
firewall is located on a computer with the application [US 5826014, Col 7, Ln 24-34]. 

Claims 18 and 19 are rejected because it is directed to the same subject matter as 
claim 1. 



Application/Control Number: 

10/603,648 

Art Unit: 2132 



Page 9 



Claim 20 is rejected because it is directed to the same subject matter as claim 14. 

2. Claims 21-26, 30, 33, and 37-38 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Malcolm [US 7146638 B2], and further in view of Montenegro [US 
6233688 B1]. 

Regarding claim 21, Malcolm teaches a computer-implemented method, comprising: 
receiving, by an interception module [US 7146638 B2, Col 5, Ln 60-65 - Examiner 
notes that intercepting access requests from application program is evidence of an 
interception module.] and a filter cache [US 7146638 B2, Col 7, Ln 36-41 -- Examiner 
notes the retrieval of a configuration of granting/deny access requests based from 
comparing access request parameters with the access rules is evidence of a filter 
cache.], a connect attempt, a listen attempt, or a combination thereof from an 
application or a service [US 7146638 B2, Col 7, Ln 51-59]; extracting, by the 
interception module, user and application or service information from the connect 
attempt, the listen attempt, or the combination thereof [US 7146638 B2, Col 4, Ln 26- 
37]; identifying, by the interception module, a user and the application or the service 
from the user and application or service information [US 7146638 B2, Col 4, Ln 26-37]; 
evaluating, by the interception module, the application or service information to 
determine if the connect attempt, the listen attempt, or the combination thereof comply 
with one or more policies from a plurality of policies [US 7146638 B2, Col 7, Ln 36-41]; 
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and if the connect attempt, the listen attempt, or the combination thereof comply with 
one or more policies from the plurality of policies, instructing, by the interception 
module, a firewall to create a configuration to allow the connect attempt, the listen 
attempt, or the combination thereof, and storing the configuration in the filter cache [US 
7146638 B2, Col 9, Ln 38-52 - Examiner notes that approving/denying of access 
requests based from evaluating access requests against access rules that covers such 
requests is evidence that configurations have been created for those requests. 
Examiner also notes that access rules read on firewall policies.]. 

Malcolm does not explicitly teach an application programming interface. Montenegro 
teaches a firewall traversal method regarding loading an application programming 
interface (API) onto the client system [US 6233688 B1, Col 7, Ln 17-20]. 

It would have been obvious to one of ordinary skilled in the art at the time of invention to 
implement an application programming interface as taught by Montenegro. The 
suggestion/motivation for implementing an application programming interface would 
have been to provide an interface between applications and the operating system 
achieving a form of standardization for applications to interface with the operating 
system. Montenegro is an analogous art because it solves the problem by providing the 
means of an interface between applications and an operating system. 
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Regarding claim 22, Malcolm and Montenegro teaches the method of claim 21 , further 
comprising if the connect attempt, the listen attempt, or the combination thereof do not 
comply with one or more policies from the plurality of policies, sending a notification to 
the user of the application or service [US 7146638 B2, Col 9, Ln 53-59]. 

Regarding claim 23, Malcolm and Montenegro teaches the method of claim 22, wherein 
the notification comprises a selection to allow a connection [US 7146638 B2, Col 9, Ln 
59]. 

Regarding claim 24, Malcolm and Montenegro teaches the method of claim 21, wherein 
establishing the policy comprises receiving a policy from the application or service [US 
7146638 B2, Col 4, Ln 26-37] [Examiner notes for examining purposes, establishing the 
policy is interpreted as providing all access rules/requirements by the application 
program as cited.]. 

Regarding claim 25, Malcolm and Montenegro teaches the method of claim 24, wherein 
receiving the policy comprises receiving the policy via the application programming 
interface [An application programming interface would have been inherent.]. 

Regarding claim 26, Malcolm and Montenegro teaches the method of claim 24, wherein 
the policy received from the application or service comprises inbound or outbound 
restrictions using one or more Internet Protocol addresses, information about a subnet, 
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information about scope of the connection, or combinations thereof [US 7146638 B2, 
Col 4, Ln 28-37]. 

Regarding claim 30, Malcolm and Montenegro teaches the method of claim 21, wherein 
the firewall comprises a host firewall located on a computer with the application [US 
7146638 B2, Fig 1, Itm 24]. 

Claim 33 and 37 are rejected because it is directed to the same subject matter as claim 
21. 

Regarding claim 38, Malcolm and Montenegro teaches the computer system of claim 
37, wherein the interception module comprises a policy cache for storing the plurality of 
policies [US 7146638 B2, Col 7, Ln 25-27]. 

3. Claim 6 is rejected under 35 U.S.C. 103(a) as being unpatentable over Coley et 
al. [US 5826014], hereinafter Coley, Montenegro [US 6233688 B1], and further in view 
of Hedge et al. [US 6925495 B2], hereinafter Hedge. 

Regarding 6, Coley and Montenegro teaches the method of claim 1. But Coley and 
Montenegro does not teach wherein the parameters comprise a request for bandwidth 
or connection throttling for the connection. 
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Hedge teaches a computer-implemented method, comprising: receiving a call from an 
application [US 6925495 B2, Fig 5, Itm 510 - Examiner notes that an application is 
inherent in a requesting device], the call having parameters for a connection to an 
endpoint that the application desires to establish [US 6925495 B2, Fig 8], whereby the 
application explicitly communicates a request to establish the connection and making a 
call to a firewall to establish the connection in accordance with the parameters [US 
6925495 B2, Col 13, Ln 22-31], wherein the parameters comprise a request for 
bandwidth or connection throttling for the connection [US 6925495 B2, Col 16, Ln 10- 
11]. 



It would have been obvious to one of ordinary skill in the art at the time of invention to 
accommodate a request for bandwidth or connection throttling as one of the parameters 
as taught by Hedge. The suggestion/motivation for the accommodation of bandwidth 
request is that since many sites rely on the user having a high bandwidth when 
streaming media to the user, bandwidth allocation is needed in a firewall to optimize 
content delivery [US 6925495 B2, Col 1, Ln 47-50]. Hedge is an analogous art because 
Hedge solves the problem of optimizing content delivery over a network by requesting 
and accommodating bandwidth allocation. 

4. Claim 9 is rejected under 35 U.S.C. 103(a) as being unpatentable over Coley et 
al. [US 5826014], hereinafter Coley, Montenegro [US 6233688 B1], and further in view 
of Keane et al. [US 2003/0131263 A1], hereinafter Keane. 
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Regarding claim 9, Coley and Montenegro teaches the method of claim 1 . But Coley 
and Montenegro does not teach wherein the parameters comprise turning off or on 
specific protocol options. 

Keane teaches a computer-implemented method, comprising: receiving a call [US 
2003/0131263 A1, Fig 8, Itm 800 - Examiner notes that receiving packets to be 
transported across a network is evidence of receiving a call.] from an application [US 
2003/0131263 A1, Pg 6, Par 0066 Examiner notes that network interfaces are 
application interface receiving the packets.], the call having parameters for a connection 
to an endpoint that the application desires to establish [US 2003/01 31 263 A1 , Fig 6,7], 
whereby the application explicitly communicates a request to establish the connection 
and making a call to a firewall to establish the connection in accordance with the 
parameters [US 2003/0131263 A1, Pg 7, Par 0081], wherein the parameters comprise 
turning off or on specific protocol options [US 2003/0131263 A1, Pg 7, Par 0084]. 

It would have been obvious to one of ordinary skill in the art at the time of invention to 
accommodate the specific protocol options as taught by Keane. The 
suggestion/motivation for the accommodation of specific protocol options is to provide 
information to the firewall for evaluation of a packet whose specific protocol options may 
be set [US 2003/0131263 A1, Pg 7, Par 0084]. Keane is an analogous art because 
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Keane is in the same field of transmitting packet content across a network using firewall 
modules. 

5. Claims 16-17 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Coley et al. [US 5826014], hereinafter Coley, Montenegro [US 6233688 B1], and further 
in view of Chen [US 7000006 B1]. 

♦ 

Regarding claim 16, Coley and Montenegro teaches the method of claim 1 . But Coley 
and Montenegro do not teach wherein the firewall comprises an edge firewall, and 
further comprising an agent to communicate information to the edge firewall about the 
connection. 

Chen teaches a computer-implemented method, comprising: receiving a call from an 
application via an application programming interface and making a call to a firewall to 
establish the connection [US 7000006 B1, Col 9, Ln 21-29], wherein the firewall 
comprises an edge firewall, and further comprising an agent to communicate 
information to the edge firewall about the connection [US 7000006 B1, Col 9, Ln 21-29 
- Examiner notes that intercepting communications to a corresponding secure domain 
is evidence of an application agent providing such functions.]. 

It would have been obvious to one of ordinary skill in the art at the time of invention to 
implement edge firewalls as taught by Chen. The suggestion/motivation for combining 
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Chen would have been to reduce the amount of processing time involved in configuring 
networks for policy managements [US 7000006 B1 , Col 1 , Ln 40-47] because the 
network can be abstracted into domains thus having reduced topology and internal 
connectivity [US 7000006 B1, Col 1, Ln 51-59] which is made possible by implementing 
edge firewalls. Chen is an analogous art because Chen solves the problem of being 
able to reduce the amount of processing time involved in configuring networks for policy 
managements. 

Regarding claim 17, Coley, Montenegro, and Chen teach the method of claim 1, 
wherein the firewall comprises an edge firewall [US 7000006 B1, Col 9, Ln 21-29], and 
further comprising an authenticated protocol [US 7000006 B1, Col 2, Ln 65-67 -- 
Examiner notes authentication modules is evidence of authenticated protocols.] to 
communicate information to the edge firewall about the connection. 

6. Claims 31 , 32, and 39 are rejected under 35 U.S.C. 1 03(a) as being 
unpatentable over Malcolm [US 7146638 B2], Montenegro [US 6233688 B1], and 
further in view of Chen [US 7000006 B1]. 

Regarding claim 31 , Malcolm and Montenegro teaches the method of claim 21 . But 
Malcolm and Montenegro do not teach wherein the firewall comprises an edge firewall, 
and further comprising an agent to communicate information about the connection. 
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Chen teaches a computer-implemented method, comprising: receiving a connect 
attempt, a listen attempt, or a combination thereof from an application or a service [US 
7000006 B1, Col 9, Ln 24-25]; evaluating, by the interception module, the application or 
service information to determine if the connect attempt, the listen attempt, or the 
combination thereof comply with one or more policies from a plurality of policies [US 
7000006 B1 , Col 9, Ln 1 1 -1 5]; and if the connect attempt, the listen attempt, or the 
combination thereof comply with one or more policies from the plurality of policies, 
instructing, by the interception module, a firewall to allow the connect attempt, the listen 
attempt, or the combination thereof [US 7000006 B1 , Col 3, Ln 10-13], wherein the 
firewall comprises an edge firewall, and further comprising an agent to communicate 
information to the edge firewall about the connection [US 7000006 B1 , Col 9, Ln 21-29 
~ Examiner notes that intercepting communications to a corresponding secure domain 
is evidence of an application agent providing such functions.]. 

It would have been obvious to one of ordinary skill in the art at the time of invention to 
implement edge firewalls as taught by Chen. The suggestion/motivation for combining 
Chen would have been to reduce the amount of processing time involved in configuring 
networks for policy managements [US 7000006 B1 , Col 1 , Ln 40-47] because the 
network can be abstracted into domains thus having reduced topology and internal 
connectivity [US 7000006 B1, Col 1, Ln 51-59] which is made possible by implementing 
edge firewalls. Chen is an analogous art because Chen solves the problem of being 
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able to reduce the amount of processing time involved in configuring networks for policy 
managements. 

Regarding claim 32, Malcolm, Montenegro, and Chen teach the method of claim 21, 
wherein the firewall comprises an edge firewall [US 7000006 B1, Col 9, Ln 21-29], and 
further comprising an authenticated protocol [US 7000006 B1, Col 2, Ln 65-67 - 
Examiner notes authentication modules is evidence of authenticated protocols.] to 
communicate information to the edge firewall about the connection. 

Claim 39 is rejected because it is the system performing the method of claim 31. 

7. Claims 27-29 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Malcolm [US 7146638 B2], Montenegro [US 6233688 B1], and further in view of Keane 
et al. [US 2003/0131263 A1], hereinafter Keane. 

Regarding claim 27, Malcolm and Montenegro teach the method of claim 24. But 
Malcolm and Montenegro does not teach wherein the policy received from the 
application or service comprises communication security level. 

Keane teaches a computer-implemented method, comprising: receiving a connect 
attempt, a listen attempt, or a combination thereof from an application or a service [US 
2003/0131263 A1, Fig 8, Itm 800]; evaluating, the application or service information to 
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determine if the connect attempt, the listen attempt, or the combination thereof comply 
with one or more policies from a plurality of policies [US 2003/0131263 A1, Pg 7, Par 
0081],wherein establishing the policy comprises receiving a policy from the application 
or service [US 2003/0131263 A1, Pg 5, Par 0061-0062],wherein the policy received 
from the application or service comprises communication security level [US 
2003/01321263 A1, Pg 3, Par 0040] [US 2003/0131263 A1, Pg 4, Par 0042]; and if the 
connect attempt, the listen attempt, or the combination thereof comply with one or more 
policies from the plurality of policies, instructing, a firewall to allow the connect attempt, 
the listen attempt, or the combination thereof [US 2003/0131263 A1, Pg 7, Par 0080]. 

It would have been obvious to one of ordinary skill in the art at the time of invention to 
accommodate policies with communication security levels as taught by Keane. The 
suggestion/motivation for the accommodation of communication security levels as part 
of the policies is to provide secure private connections over the Internet by enabling 
authentication of users and locations and encryption of communication, thereby 
delivering secure and private "tunnels" between users or locations and thus establishing 
a virtual private network, or VPN [US 2003/0131263 A1, Pg 1, Par 0009]. Keane is an 
analogous art because Keane is in the same field of transmitting packet content across 
a network using firewall modules. 
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Regarding claim 28, Malcolm, Montenegro, and Keane teach the method of claim 27, 
wherein the communication security level comprises authentication [US 2003/0131263 
A1, Pg4, Par 0042]. 

Regarding claim 29, Malcolm, Montenegro, and Keane teach the method of claim 27, 
wherein the communication security level comprises encryption [US 2003/01321263 A1, 
Pg 3, Par 0040]. 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Martin Jeriko P. San Juan whose telephone number is 
571-272-7875. The examiner can normally be reached on M-F 8:30a - 6:00p EST. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gilberto Barron can be reached on 571-272-3799. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



/MJSJ/ 



Martin Jeriko San Juan 
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